Account ≠ Identity
An IE Account is auth and plan on the product. Geometry lives only on Identities. Harnesses bind to an Identity, never to an anonymous account mode.
Product language drifts easily toward "one account ≈ one Identity ≈ one installation". That collapse is costly. It hides who has geometry, who may write, and who is the actor on every mutation.
This essay locks the separation that the OS already treats as architecture contract. It is positioning, not a new Core Concept. It exists so Surface bindings, MCP sessions, and multi-substrate agents cannot be misread as account modes.
Account, Identity, Space, Harness
IE Account: auth and billing/plan on the IE product (managed path only).
Identity: geometric unit. Stem, Registry, Mass, Surface, Public Card, signals.
Space: membrane host. Membership, Surface hosting, jurisdiction policy. See One Space.
Harness / Runtime / Agent: substrate of an Identity, not a mode of the human owner.
One account may hold many Identities, independent of substrate. A human Identity, an agent Identity, an idea Identity, and a cloud-runtime Identity are the same kind of geometric object. They differ in substrate and in the jurisdiction relations between them, not in whether a Surface may write.
Silent Root Power
If account and Identity are treated as one, several failures follow at once:
- →An agent session is silently elevated to the human Identity.
- →MCP or CLI mutations lose an explicit actor.
- →Cross-Identity writes look like product features instead of grants.
- →Local Free geometry appears to require an account.
Under multi-substrate symmetry, agents, ideas, and runtimes are Identities. Each harness that acts for long enough deserves its own local geometry, its own Registry perspective, and its own Public Card. The human who holds the account creates those Identities and decides their jurisdiction. That decision is not "MCP is read-only".
Harnesses Bind to Identity
A harness (desktop CLI process, mobile app, chat-agent session, cloud worker) binds to one Identity at a time. Switching Identity is an explicit context switch, never a silent elevation to account-root.
Surface and MCP bindings always write as the Identity under which the session is authenticated. Scope is jurisdiction over that Identity (and any explicit grants to others), not a global read/write flag on the account.
Every mutation carries actor_identity_id. There is no implicit "the account did this". UI, CLI, and MCP sessions that act as the human Identity record the human Identity as actor. Agent sessions record the agent Identity. Audit and Mature history stay geometrically honest.
Self-Write Is Full; Cross-Write Is Grant-Scoped
When authenticated as Identity I:
- →Read and write I's own geometry (Stem, Registry, Mature, policy of I) is allowed.
- →Mutate Identity J under the same account or Space only with an explicit grant.
- →Account-level ops (billing, plan, delete account) stay on the account holder role.
Self-write is full. Cross-Identity write is a grant question, not an MCP capability question. Cross-Space visibility is a membrane question. Creation-time default grants (seeCreation as First Access Agreement) give the creator an initial transferable package; ordinary Parent power remains Child-revocable.
No Mandatory Account
Local Free ships one local Identity per installation as a valid mini-Space: no account required, full Ownership of the files, Surface and Mature on that single Identity.
Multi-Identity and multi-Space are the same model at larger cardinality. The contract does not invent a second meaning of Identity when N greater than 1 lands. Managed continuity is optional continuity of the same geometry, not a change of geometric contracts by subscription tier.
What This Separation Refuses
- →Replacing local Free with a mandatory account
- →Making every agent automatically the human Identity
- →Silent cross-Identity Mature or policy writes
- →Treating subscription tier as a change of geometric contracts
- →Requiring a global shared Registry across Spaces
Positioning, Already Operational
This essay makes public a separation that is already locked in the OS architecture contract. It does not introduce a new geometric primitive. It prevents product language from collapsing who pays, who has geometry, where membrane sits, and where the process runs.
Open Core:account-identity-model.md.
Where the work continues
- →One Space: membrane host of Identities
- →Creation as First Access Agreement: lineage and default grants
- →Ownership as Relative Jurisdiction: Access and Jurisdiction as degrees of freedom
- →OS: Identity creation, Surface binding, local Free